discordrat | 3b46e7f9db47c338590d7934145579799c2ed82e4ec4ca33de8cd00d42fc4a1e | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Spoffer.exe
Size

78KB
MD5

b3e26af2b5a30b898598ff249775f57d
SHA1

222b453cdfee930e62ce99cd3b959c10911d4f24
SHA256

3b46e7f9db47c338590d7934145579799c2ed82e4ec4ca33de8cd00d42fc4a1e
SHA512

a1e0bb3bfa391075f173a483f902ce5abf6f50ce9e17a5ec686f06787ef0c808163f586024c5e4137995b50b5227b647c63e68a7edcdb0f05d8a8b2d62d28c42
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+yPIC:5Zv5PDwbjNrmAE++IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5MzkzNjk4NDE3NTI4NDIyNQ.GHVwqc.oVE-laJFGZqCBjLAbY3CY7gEr1zASuiKNJ_rAE
server_id
1293938026614886441

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1372	2180	Spoffer.exe	30
PID 2180 wrote to memory of 1372	2180	Spoffer.exe	30
PID 2180 wrote to memory of 1372	2180	Spoffer.exe	30

C:\Users\Admin\AppData\Local\Temp\Spoffer.exe
"C:\Users\Admin\AppData\Local\Temp\Spoffer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2180 -s 596
  2⤵
  PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-0-0x000007FEF5B23000-0x000007FEF5B24000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x000000013FD10000-0x000000013FD28000-memory.dmp

Filesize
96KB

Download
memory/2180-2-0x000007FEF5B20000-0x000007FEF650C000-memory.dmp

Filesize
9.9MB

Download
memory/2180-3-0x000007FEF5B20000-0x000007FEF650C000-memory.dmp

Filesize
9.9MB

Download